Pith. sign in

REVIEW 3 major objections 4 minor 55 references

This paper establishes necessary and sufficient conditions for a quantum code to be list-decodable and gives a pseudorandom-unitary protocol that decodes such codes unambiguously, with security against quantum-polynomial-time adversaries an

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

The paper gives a generalized Knill-Laflamme condition for quantum list-decodable codes and a pseudorandom-unitary protocol for unambiguous list decoding that is claimed to be secure against polynomial-time quantum adversaries with key reuse.

T0 review reviewed 2026-08-04 challenge →

load-bearing objection An interesting protocol idea, but both headline results have load-bearing gaps: the generalized KL condition is circular, and key-reuse security does not follow from PRU oracle security. the 3 major comments →

arxiv 2509.08943 v1 pith:WFNGLSEV submitted 2025-09-10 quant-ph cs.CR

Quantum Error Correction in Adversarial Regimes

Rahul Arvind , Nikhil Bansal , Dax Enshan Koh , Tobias Haug , Kishor Bharti This is my paper
classification quant-ph cs.CR MSC 81P7081P94 PACS 03.67.Pp03.67.Dd
keywords quantum list decodingpseudorandom unitariesKnill-Laflamme conditionsadversarial noisecryptographic quantum error correctionkey reusestabilizer codesapproximate quantum error correction
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks when quantum codes can be list-decoded and how to decode them when an adversary deliberately corrupts the data. It answers the first with generalized conditions, an analogue for list decoding of the standard Knill-Laflamme error-correction conditions. It answers the second with a protocol that appends a short tag register, scrambles the state under a pseudorandom unitary, and then tries each candidate list error, accepting only when the tag measures zero. The decoding succeeds with negligible error even when a quantum-polynomial-time adversary holds many copies of the encoded state and the same key is reused, something previous list-decoding schemes could not offer. If correct, this connects coding theory with complexity-based cryptography and opens a route to error correction that withstands deliberate, adaptive attacks.

Core claim

The central discovery is twofold. First, a quantum stabilizer code is L-list decodable exactly when the standard Knill-Laflamme condition holds across the code projector: errors with different syndromes are orthogonal (Π_Q E†F Π_Q = 0), and same-syndrome errors are proportional to Π_Q with a coefficient α(E,F) built from the recovery map's unitary freedom. Second, unambiguous decoding can be made computationally secure by encoding the state together with an m-qubit tag under a pseudorandom unitary. For any list error, the protocol applies the inverse unitary and the inverse of a candidate error, then measures whether the tag is still zero. A wrong candidate fails the tag with probability 1 -

What carries the argument

The protocol hinges on pseudorandom unitaries (keyed families of efficiently preparable unitaries computationally indistinguishable from Haar-random unitaries) with the additional property of being exact 2-designs and relative-error approximate 4-designs. These supply two effects: under the 2-design, the m-qubit tag is highly entangled with the data for any wrong list error, so the tag-zero projection succeeds with probability about 2^{-m}; the 4-design bound shows that a failed projection leaves the state nearly unchanged, so the decoder can keep trying list elements without destroying the state. The generalized Knill-Laflamme conditions identify exactly when the initial list decoding can r

Load-bearing premise

The security under key reuse assumes that a computationally bounded adversary holding many copies of states encoded with the same pseudorandom key cannot learn the key or choose noise correlated with it; the paper's formal indistinguishability definition is for oracle access to the unitaries, not for samples of encoded states.

What would settle it

A quantum-polynomial-time algorithm that, given t = poly(n) copies of Uλ(|φ⟩|0⟩^m) for unknown λ, recovers λ or produces a Pauli error correlated with λ that makes the decoder fail with non-negligible probability would disprove Corollary 1. Concretely, any key-extraction attack on the PRU family from sample access—while it remains oracle-indistinguishable—would break the average-case argument.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A code's list-decodability can be certified by checking projector-matrix elements rather than by searching over decoding maps.
  • A single copy of a corrupted list-decodable state is enough to decode unambiguously with negligible error for polynomial list size.
  • The constructed code is a key-reusable cryptographic approximate quantum error-correcting code against (α, t)-quantum-polynomial-time adversaries, for t = poly(n) copies.
  • The scheme is low-depth implementable because the required pseudorandom unitaries with 2- and 4-design properties can be generated in polylogarithmic depth.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same tag-and-PRU construction likely doubles as a key-reusable quantum authentication or purity-testing scheme, since the zero-tag measurement is exactly a test that no harmful error occurred.
  • The generalized Knill-Laflamme conditions may yield rate-versus-distance bound for quantum list codes (a quantum analogue of the Singleton bound), by analogy with classical list decoding.
  • Extending the argument to subsystem codes, Floquet codes, or spacetime codes is a natural test; the structural condition should carry over wherever a syndrome projector exists.
  • Numerical threshold studies for specific stabilizer codes under adversarial noise could reveal whether the asymptotic security advantage persists at practical block sizes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper claims two main results. First, a generalized Knill-Laflamme condition for quantum list-decodable stabilizer codes (Theorem 1): errors with different syndromes are orthogonal on the code space, while errors with the same syndrome satisfy Π_Q E†F Π_Q = c(s) α(E,F) Π_Q, with α defined through the recovery map's unitary freedom. Second, an unambiguous list-decoding protocol (Algorithm 1) based on pseudorandom unitaries: the sender appends m ancillas, applies a PRU U_λ, and encodes into a list-decodable code; the decoder tests list errors one by one using the ancilla projector Π = I ⊗ |0⟩⟨0|^{⊗m}. Under exact 2-design and approximate 4-design assumptions, the protocol is claimed to achieve fidelity 1−negl(n) (Theorem 2), and the construction is claimed to be a cryptographic approximate QECC secure against (α,t)-QPT adversaries with key reuse (Corollary 1).

Significance. If the results were correct, they would be a significant step: a KL-type structural characterization of quantum list decodability and the first computationally secure, key-reusable QECC construction based on list decoding. The central idea of using PRU-based purity testing to disambiguate list errors is appealing, and the Haar-integral calculations in Appendix B are detailed. However, the main structural theorem is false as stated, and the security proof for key reuse contains a logical gap that is load-bearing for the advertised claims. As written, the paper does not establish its principal results.

major comments (3)
  1. [Theorem 1 / Eq. (3) / Appendix A, Eq. (A6)] The same-syndrome condition is not valid. For stabilizer-distinct Pauli errors E,F with Syn(E)=Syn(F), E†F lies in N(Q)∖G(Q), so Π_Q E†F Π_Q is a logical operator on the code space, not a multiple of Π_Q unless k=0. The derivation in Eq. (A6) produces an operator identity involving Π_Q E_i† E_j Π_Q, and since E_i†E_j ∈ N(Q), the right-hand side is a sum of logical operators. Thus α(E,F) in Eq. (3) is an operator, not a scalar, and the claimed scalar KL-type condition fails. The sufficiency proof also relies on the scalar form to construct an isometry, so that part does not go through.
  2. [Corollary 2 proof (Appendix C)] The proof states that because U_λ is a PRU, no QPT adversary can learn the key, and hence the error channel used by the adversary is independent of the key. This is a non-sequitur. Definition 3 gives oracle indistinguishability, while Definition 6 gives the adversary t=poly(n) copies of U_λ(|φ⟩|0⟩^{⊗m}) and allows adaptive error choice. No reduction connects the t-copy sample setting to Definition 3. An adversary can choose an error correlated with λ through the sample without recovering λ. Propositions 1–2 and Theorem 2 fix the error E_j before averaging over keys; once the error is selected after seeing the encoded copies, the good-key set depends on the error and the Markov averaging argument collapses. This gap is load-bearing for the key-reuse claim.
  3. [Definition 1 vs. Definition 8 / Theorem 3] The main-text definition of L-QLD (Definition 1) is combinatorial: at most L stabilizer-distinct errors per syndrome. But the proof of Theorem 1 in Appendix A uses a recovery-map definition (Definition 8), and the condition quantifies over the recovery map's unitary freedoms U(E), U(F). Thus the theorem does not characterize the code alone; it is essentially a restatement of the existence of the decoder. The necessity direction merely expands the recovery Kraus operators, and the sufficiency direction rebuilds the recovery map from the assumed condition. Because the condition is defined through those very objects, it is not a useful code-only criterion and falls short of being a genuine generalized Knill-Laflamme condition.
minor comments (4)
  1. [Notation in Theorem 2 / Proposition 2] The main text uses δ = Θ(2^{-m}+polylog(n)) in Theorem 2 and Corollary 1, while Proposition 2 uses δ = Θ(2^{-m+polylog(n)}). The fidelity bound '1−Θ(L 2^{-m/2}+polylog(n))' would be non-negligible if the polylog term is not scaled by the negligible factor; the intended scaling should be clarified.
  2. [Appendix A, Definition 8] In the output of the recovery map, the sum is written as Σ c(s) E_i Π_Q ρ Π_Q E_i†. Since each E_i has the same syndrome as E, E_i Π_Q maps the code space to a syndrome subspace, so the right-hand side is not a state on the code space unless the output is projected back. This needs clarification.
  3. [Lemma 1] Lemma 1 assumes C_Q† E_i^s C_Q = P_i^s ⊗ A_i^s for the list errors. This relation is not shown to hold for the list errors of an arbitrary L-QLD code, so the reduction from physical-space list errors to logical-space list errors is not fully general.
  4. [Theorem 1 definition of α(E,F)] In the main text, α(E,F) = Σ_{k,i,j} U^*(E)_{ki} Π_Q E_i† U(F)_{kj} E_j omits the trailing Π_Q that appears in Eq. (A6). As written, α(E,F) is not an operator acting on the code space, and the equation is dimensionally inconsistent.

Circularity Check

2 steps flagged

Generalized Knill-Laflamme condition is a tautological restatement of list-decodability; key-reuse security assumes key-independent noise as a premise.

specific steps
  1. self definitional [Theorem 1 / Appendix A, Definition 8, Eq. (A4), Proof of Theorem 3]
    "where α(E, F) = P k,i,j U ∗(E)kiΠQE† i U(F) kj Ej depend on E, F with U(E) and U(F) being unitary matrices... For error F, we have then ... R kFΠ Q = P i p c(s)U(F) kiEiΠQ [41] for some unitary U(F) relating the two Kraus operator decompositions. ... Taking the adjoint ... Π QE†FΠ Q = c(s)α(E, F)Π Q."

    The proposed necessary-and-sufficient condition is not stated in terms of the code and error set alone: α(E,F) is defined through the recovery map's Kraus unitaries U(E), U(F) and the list errors E_i, which are precisely the objects whose existence the theorem is supposed to certify. Necessity only expands R_k from the L-QLD recovery definition; sufficiency assumes the same decomposition and reconstructs the recovery map. Thus the 'condition' is Definition 8 rewritten, not an independent KL-type characterization. It cannot be checked from Q and E without already knowing the decoder.

  2. other [Corollary 2 proof (Appendix C), supported by Discussion]
    "Firstly, we argue that since {U λ}λ is PRU, no computationally bounded adversary with polynomial queries to it can distinguish it from Haar random unitaries. Consequently, there is no way for a computationally bounded adversary to learn the key used in the protocol. Thus, the error channel used by the adversary will be independent of the key."

    Definition 6 gives the adversary t copies of the keyed encoded state and allows it to choose Pauli errors adaptively; such an adversary can produce a key-correlated error without ever outputting the key. The proof replaces this with the weaker statement that the adversary cannot learn the key from oracle indistinguishability (Definition 3) and then asserts that the error channel is key-independent. That assertion is exactly the key-reuse security needed for the key-average in Theorem 2 to apply; it is not derived from PRU security. The conclusion is therefore assumed as the premise that the errors are independent of the key.

full rationale

The clearest circularity is the generalized Knill-Laflamme condition: the theorem's α(E,F) is built from the recovery map's Kraus unitaries and the list errors, so the condition is a restatement of the definition of quantum list decodability rather than a testable condition on the code. This is a central structural claim, so it raises the score. The key-reuse proof in Corollary 2 contains a second load-bearing step that also begs the question: PRU oracle indistinguishability does not imply that an adversary with t encoded copies uses a key-independent error channel, yet the proof asserts exactly that and then averages over keys. I do not count the self-citation to [23] as a separate circular step, because the 2-design and 4-design assumptions are stated explicitly as assumptions and are anchored partly to external works [21,22]. The Haar-averaging analysis of Algorithm 1 is self-contained conditional on those stated design assumptions and is not itself circular. However, the advertised key-reuse security and the structural characterization both contain circular or question-begging reductions, so a score of 7 is appropriate.

Axiom & Free-Parameter Ledger

3 free parameters · 6 axioms · 0 invented entities

The protocol rests on three unproved inputs: existence of PRUs (cryptographic assumption), PRUs that are simultaneously exact 2-designs and approximate 4-designs with small error, and sample-security of PRUs under key reuse. The generalized KL theorem contributes no independent criterion, since α is defined in terms of the very recovery map being characterized. No new physical entities are introduced.

free parameters (3)
  • ancilla size m = m = ω(log n)
    Number of ancilla qubits; chosen asymptotically so that 2^{-m} and 2^{-m/2} are negligible. Not fitted to data, but a hand-chosen design parameter.
  • fidelity error δ = Θ(2^{-m} + polylog n)
    Introduced in Propositions 1-2 and Theorem 2 to make final fidelity 1 - negl(n); a scaling choice, not a measured quantity.
  • PRU 4-design error ε = O(2^{-m})
    Assumed relative error of the approximate 4-design; needed for the fidelity bounds in Proposition 2 and Theorem 2.
axioms (6)
  • domain assumption Pseudorandom unitaries exist and are indistinguishable from Haar for QPT adversaries.
    Definition 3, imported from [18,19]; the security of the whole scheme is conditioned on this computational assumption.
  • ad hoc to paper The PRU family is an exact 2-design and a relative-error ε = O(2^{-m}) approximate 4-design.
    Propositions 1-2 and Theorem 2 assume this; it is tailored to make the decoder's wrong-guess projection fail with tiny probability while preserving fidelity.
  • standard math Stabilizer codes and the standard Knill-Laflamme conditions hold for the uniquely correctable error set.
    Background used to define quantum list codes and the claimed generalized conditions.
  • standard math Haar integration and Weingarten calculus formulas are correct.
    Appendix B uses them to evaluate 2- and 4-design averages.
  • domain assumption Adversarial noise is modeled as weight-limited Pauli errors chosen adaptively by a QPT adversary with t copies of the code state.
    Definition 6; the claim of adversarial regimes is limited to this model and excludes other channel forms.
  • domain assumption For every L-QLD code, a decoding map exists that outputs the uniform mixture over list errors (as in Def. 8).
    List decodability is defined through this recovery map; the generalized KL condition then recovers the same object rather than providing an independent criterion.

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Quantum Error Correction in Adversarial Regimes." pith.science (2026). https://pith.science/paper/WFNGLSEV

@misc{pith2026250908943,
  author       = {Pith},
  title        = {Pith review of: Quantum Error Correction in Adversarial Regimes},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WFNGLSEV}},
  note         = {Machine review of arXiv:2509.08943}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

In adversarial settings, where attackers can deliberately and strategically corrupt quantum data, standard quantum error correction reaches its limits. It can only correct up to half the code distance and must output a unique answer. Quantum list decoding offers a promising alternative. By allowing the decoder to output a short list of possible errors, it becomes possible to tolerate far more errors, even under worst-case noise. But two fundamental questions remain: which quantum codes support list decoding, and can we design decoding schemes that are secure against efficient, computationally bounded adversaries? In this work, we answer both. To identify which codes are list-decodable, we provide a generalized version of the Knill-Laflamme conditions. Then, using tools from quantum cryptography, we build an unambiguous list decoding protocol based on pseudorandom unitaries. Our scheme is secure against any quantum polynomial-time adversary, even across multiple decoding attempts, in contrast to previous schemes. Our approach connects coding theory with complexity-based quantum cryptography, paving the way for secure quantum information processing in adversarial settings.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

55 extracted references · 9 linked inside Pith

  1. [1]

    The projection Π must succeed with a very small probability that ideally decays with the system size

  2. [2]

    The receiver should be able to recover the initial state (affected by errorE s j ) with high fidelity after applying the inverse of the wrong correction oper- atorE s b . The former condition ensures that the algorithm gives false positives with low probability, while the latter con- dition makes it possible to consecutively search through all errors with...

  3. [3]

    The algorithm iterates through the list of possible errors, and identifies the correct error with proba- bility close to 1, with high probability over the keys λand randomness in the measurement

  4. [4]

    The state returned by the algorithm and the logical state have a fidelity which is lower bounded by 1− negl(n), with high probability over the keysλand randomness in the measurement. Cryptographic approximate quantum error correction from list-decodable codes.—Now, using the above theo- rem, we can construct error correction codes with strong security gua...

  5. [5]

    C. E. Shannon, A mathematical theory of communica- tion, The Bell System Technical Journal27, 379 (1948)

    1948

  6. [6]

    R. W. Hamming, Error detecting and error correcting codes, The Bell System Technical Journal29, 147 (1950)

    1950

  7. [7]

    Tal and A

    I. Tal and A. Vardy, List decoding of polar codes, IEEE Transactions on Information Theory61, 2213 (2015)

    2015

  8. [8]

    Silverberg, J

    A. Silverberg, J. Staddon, and J. Walker, Applications of list decoding to tracing traitors, IEEE Transactions on Information Theory49, 1312 (2003)

    2003

  9. [9]

    Morillo and C

    P. Morillo and C. R` afols, The security of all bits using list decoding, inInternational Workshop on Public Key Cryptography(Springer, 2009) pp. 15–33

    2009

  10. [10]

    M. J. Mihaljevi, M. P. C. Fossorier, and H. Imai, Fast cor- relation attack algorithm with list decoding and an appli- cation, inFast Software Encryption, edited by M. Mat- sui (Springer Berlin Heidelberg, Berlin, Heidelberg, 2002) pp. 196–210

    2002

  11. [11]

    Elias, List decoding for noisy channels, Technical re- port (Massachusetts Institute of Technology

    P. Elias, List decoding for noisy channels, Technical re- port (Massachusetts Institute of Technology. Research Laboratory of Electronics)335, 94 (1957)

    1957

  12. [12]

    J. M. Wozencraft, List decoding, Quarterly Progress Re- port48, 90 (1958)

    1958

  13. [13]

    Guruswami, J

    V. Guruswami, J. Hastad, M. Sudan, and D. Zuckerman, Combinatorial bounds for list decoding, IEEE Transac- tions on Information Theory48, 1021 (2002)

    2002

  14. [14]

    Guruswami, List decoding with side information, in 18th IEEE Annual Conference on Computational Com- plexity, 2003

    V. Guruswami, List decoding with side information, in 18th IEEE Annual Conference on Computational Com- plexity, 2003. Proceedings.(IEEE, 2003) pp. 300–309

    2003

  15. [15]

    Guruswami,List decoding of error-correcting codes: winning thesis of the 2002 ACM doctoral dissertation competition, Vol

    V. Guruswami,List decoding of error-correcting codes: winning thesis of the 2002 ACM doctoral dissertation competition, Vol. 3282 (Springer Science & Business Me- dia, 2004)

    2002

  16. [16]

    C. J. Peikert,Cryptographic error correction, Ph.D. the- sis, Massachusetts Institute of Technology (2006)

    2006

  17. [17]

    Kawachi and T

    A. Kawachi and T. Yamakami, Quantum hardcore func- tions by complexity-theoretical quantum list decoding, 6 inAutomata, Languages and Programming, edited by M. Bugliesi, B. Preneel, V. Sassone, and I. Wegener (Springer Berlin Heidelberg, Berlin, Heidelberg, 2006) pp. 216–227

    2006

  18. [18]

    Leung and G

    D. Leung and G. Smith, Communicating over adversar- ial quantum channels using quantum list codes, IEEE Transactions on Information Theory54, 883 (2008)

    2008

  19. [19]

    Bergamaschi, L

    T. Bergamaschi, L. Golowich, and S. Gunn, Approach- ing the quantum singleton bound with approximate er- ror correction, inProceedings of the 56th Annual ACM Symposium on Theory of Computing, STOC 2024 (Asso- ciation for Computing Machinery, New York, NY, USA,

    2024

  20. [20]

    Bergamaschi, F

    T. Bergamaschi, F. G. Jeronimo, T. Mittal, S. Srivastava, and M. Tulsiani, List decodable quantum LDPC codes, arXiv preprint arXiv:2411.04306 (2024)

    Pith/arXiv arXiv 2024

  21. [21]

    Knill and R

    E. Knill and R. Laflamme, Theory of quantum error- correcting codes, Phys. Rev. A55, 900 (1997)

    1997

  22. [22]

    Ji, Y.-K

    Z. Ji, Y.-K. Liu, and F. Song, Pseudorandom quantum states, inAnnual International Cryptology Conference (Springer, 2018) pp. 126–152

    2018

  23. [23]

    Ma and H.-Y

    F. Ma and H.-Y. Huang, How to construct random uni- taries, inProceedings of the 57th Annual ACM Sympo- sium on Theory of Computing, STOC ’25 (Association for Computing Machinery, New York, NY, USA, 2025) p. 806–809

    2025

  24. [24]

    Dennis, A

    E. Dennis, A. Kitaev, A. Landahl, and J. Preskill, Topological quantum memory, Journal of Mathematical Physics43, 4452 (2002)

    2002

  25. [25]

    Schuster, J

    T. Schuster, J. Haferkamp, and H.-Y. Huang, Random unitaries in extremely low depth, Science389, 92 (2025)

    2025

  26. [26]

    Cleve, D

    R. Cleve, D. Leung, L. Liu, and C. Wang, Near-linear constructions of exact unitary 2-designs, Quantum Infor- mation & Computation16, 721 (2016)

    2016

  27. [27]

    T. Haug, N. Bansal, W.-K. Mok, D. E. Koh, and K. Bharti, Pseudorandom quantum authentication, arXiv preprint arXiv:2501.00951 (2025)

    Pith/arXiv arXiv 2025

  28. [28]

    Barnum, C

    H. Barnum, C. Cr´ epeau, D. Gottesman, A. Smith, and A. Tapp, Authentication of quantum messages, inThe 43rd Annual IEEE Symposium on Foundations of Com- puter Science, 2002. Proceedings.(IEEE, 2002) pp. 449– 458

    2002

  29. [29]

    Portmann, Quantum authentication with key recy- cling, Cryptology ePrint Archive, Paper 2017/119 (2017)

    C. Portmann, Quantum authentication with key recy- cling, Cryptology ePrint Archive, Paper 2017/119 (2017)

    2017

  30. [30]

    Dulek and F

    Y. Dulek and F. Speelman, Quantum Ciphertext Authen- tication and Key Recycling with the Trap Code, in13th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 2018), Leibniz International Proceedings in Informatics (LIPIcs), Vol. 111, edited by S. Jeffery (Schloss Dagstuhl – Leibniz- Zentrum f¨ ur Informatik, Dagstuhl, Ger...

    2018

  31. [31]

    S. A. Aly, A. Klappenecker, and P. K. Sarvepalli, Sub- system codes, arXiv preprint quant-ph/0610153 (2006)

    Pith/arXiv arXiv 2006

  32. [32]

    T. J. Yoder, Optimal quantum subsystem codes in two dimensions, Phys. Rev. A99, 052333 (2019)

    2019

  33. [33]

    Klappenecker and P

    A. Klappenecker and P. K. Sarvepalli, On subsys- tem codes beating the quantum Hamming or Singleton bound, Proceedings of the Royal Society A: Mathemati- cal, Physical and Engineering Sciences463, 2887 (2007)

    2007

  34. [34]

    Bacon and A

    D. Bacon and A. Casaccino, Quantum error correcting subsystem codes from two classical linear codes, arXiv preprint quant-ph/0610088 (2006)

    Pith/arXiv arXiv 2006

  35. [35]

    Davydova, N

    M. Davydova, N. Tantivasadakarn, and S. Balasubra- manian, Floquet codes without parent subsystem codes, PRX Quantum4, 020341 (2023)

    2023

  36. [36]

    Tanggara, M

    A. Tanggara, M. Gu, and K. Bharti, Simple construc- tion of qudit Floquet codes on a family of lattices, arXiv preprint arXiv:2410.02022 (2024)

    Pith/arXiv arXiv 2024

  37. [37]

    Fahimniya, H

    A. Fahimniya, H. Dehghani, K. Bharti, S. Mathew, A. J. Koll´ ar, A. V. Gorshkov, and M. J. Gullans, Fault- tolerant hyperbolic Floquet quantum error correcting codes, Quantum9, 1849 (2025)

    2025

  38. [38]

    Zhang, D

    Z. Zhang, D. Aasen, and S. Vijay,x-cube Floquet code: A dynamical quantum error correcting code with a subex- tensive number of logical qubits, Phys. Rev. B108, 205116 (2023)

    2023

  39. [39]

    Bacon, S

    D. Bacon, S. T. Flammia, A. W. Harrow, and J. Shi, Sparse quantum codes from quantum circuits, IEEE Transactions on Information Theory63, 2464 (2017)

    2017

  40. [40]

    Gottesman, Opportunities and challenges in fault-tolerant quantum computation, arXiv preprint arXiv:2210.15844 (2022)

    D. Gottesman, Opportunities and challenges in fault-tolerant quantum computation, arXiv preprint arXiv:2210.15844 (2022)

    Pith/arXiv arXiv 2022

  41. [41]

    Delfosse and A

    N. Delfosse and A. Paetznick, Spacetime codes of Clifford circuits, arXiv preprint arXiv:2304.05943 (2023)

    Pith/arXiv arXiv 2023

  42. [42]

    Tanggara, M

    A. Tanggara, M. Gu, and K. Bharti, Strategic code: A unified spatio-temporal framework for quantum error- correction, arXiv preprint arXiv:2405.17567 (2024)

    Pith/arXiv arXiv 2024

  43. [43]

    Hinsche, J

    M. Hinsche, J. Eisert, and J. Carrasco, The abelian state hidden subgroup problem: Learning stabilizer groups and beyond, arXiv preprint arXiv:2505.15770 (2025)

    Pith/arXiv arXiv 2025

  44. [44]

    Cr´ epeau, D

    C. Cr´ epeau, D. Gottesman, and A. Smith, Approxi- mate quantum error-correcting codes and secret shar- ing schemes, inAdvances in Cryptology – EUROCRYPT 2005, edited by R. Cramer (Springer Berlin Heidelberg, Berlin, Heidelberg, 2005) pp. 285–301

    2005

  45. [45]

    M. A. Nielsen and I. L. Chuang,Quantum Computation and Quantum Information(Cambridge University Press, 2000)

    2000

  46. [46]

    A. A. Mele, Introduction to Haar Measure Tools in Quan- tum Information: A Beginner’s Tutorial, Quantum8, 1340 (2024)

    2024

  47. [47]

    Fukuda, R

    M. Fukuda, R. K¨ onig, and I. Nechita, RTNI—a symbolic integrator for Haar-random tensor networks, Journal of Physics A: Mathematical and Theoretical52, 425303 (2019). END MA TTER Definition of pseudorandom unitaries.—We denote the set of pure states over a Hilbert spaceHusingS(H). Further, we consider the set of unitary operators on the Hilbert space and...

    2019

  48. [48]

    Efficiently preparable: There is a quantum polyno- mial time algorithmMsuch that for allλ∈ Kand |ψ⟩ ∈S(H),M(λ,|ψ⟩) =U λ|ψ⟩

  49. [49]

    any QPT algorithm cannot distinguish between PRUs and Haar random unitaries

    Computational Indistinguishability: For any quan- tum polynomial time (QPT) algorithmAmaking O(poly(κ))queries to the PRUs and the Haar ran- dom unitaries, Pr λ←K [AUλ (1κ) = 1]−Pr U←µ H [AU (1κ) = 1] ≤negl(λ), (11) i.e. any QPT algorithm cannot distinguish between PRUs and Haar random unitaries. Alternate Definition of Quantum list decoding.— Definition ...

  50. [50]

    Enc takes input as keyλandn-qubit logical state |ψ⟩⟨ψ|and outputsn ′ encoded qubits

  51. [51]

    Dec takes input as the same keyλandn ′ noisy stateρand outputs an-qubit stateσ. We call a cryptographic approximate quantum error cor- recting code to be(A, δ)-secure if sup |ψ⟩ E[TD(Decλ ◦ A ◦Encλ(|ψ⟩),|ψ⟩)]≤δ(17) where the expectation is over both keys and randomness in the algorithm, and whereAis some efficient adversar- ial channel, and we denote the ...

  52. [52]

    Probability calculations 11

  53. [53]

    Fidelity calculations 13 C. Unique quantum list decoding 16 Appendix A: Proof of Knill-Laflamme conditions for quantum list decoding To show the Knill-Laflamme conditions for quantum list decoding, it is important to be exact about the definition that we start with before we can derive the necessary and sufficient conditions. We will use the Def. 1 to der...

  54. [54]

    Then, Z U P1(U)dU∼1−2 −m.(B2) Proof.We begin with the integral for the probability of projection onto the|0⟩ ⟨0|⊗m state when the wrong correction operator is applied

    Probability calculations Theorem 4.LetP 1 be, P1(U) = 1−Tr (In ⊗ |0⟩ ⟨0|)U† Es 1Es j U|ϕ⟩ ⟨ϕ| ⊗ |0⟩ ⟨0|⊗m U †Es j Es 1 U (B1) withE s 1 andE s j are the first element of the list and the true error respectively, andE s 1 ̸=E s j . Then, Z U P1(U)dU∼1−2 −m.(B2) Proof.We begin with the integral for the probability of projection onto the|0⟩ ⟨0|⊗m state when ...

  55. [55]

    Proof.It is important to check whether our protocol works with only a single state, i.e

    Fidelity calculations Theorem 5(Restatement of Proposition 2).The fidelityF(ρ λ,1, ρλ,0)given as F(ρ λ,1, ρλ,0) = 1 Pλ,1 Tr h ρλ,0Es 1Uλ(I−Π)U † λEs 1ρλ,0Es 1Uλ(I−Π)U † λEs 1 i .(B23) withρ λ,0 =E s j Uλ|ϕ,0⟩⟨ϕ,0|U † λEs j is the initial state,ρ λ,1 = 1 Pλ,1 Es 1Uλ(I−Π)U † λEs 1ρλ,0Es 1Uλ(I−Π)U † λEs 1 withE s 1 and Es j are list errors such thatE s 1 ̸=E...

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.